Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Inaccurate Utilization Rate Calculation Due to Non-Normalized Debt

agbanusijohn

Summary

The reserve interest update logic uses the raw total debt (reserve.totalUsage) to compute the utilization rate rather than using normalized debt, which factors in accrued interest. This leads to an understated utilization rate.

Vulnerability Details

In the code https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/libraries/pools/ReserveLibrary.sol#L208-L218

uint256 totalLiquidity = reserve.totalLiquidity;
uint256 totalDebt = reserve.totalUsage;
​
uint256 computedDebt = getNormalizedDebt(reserve, rateData);
uint256 computedLiquidity = getNormalizedIncome(reserve, rateData);
​
// Calculate utilization rate
uint256 utilizationRate = calculateUtilizationRate(reserve.totalLiquidity, reserve.totalUsage);

To calculate the utilization rate, the approach would be to use the normalized debt obtained via getNormalizedDebt as computedDebt and computedLiquidity. By neglecting accrued interest, the resulting utilization rate is lower than it should be, thereby causing borrow and debt rates to be miscalculated.

Impact

  • Mispricing of interest rates due to underreported utilization.

Tools Used

Manual code review

Recommendations

Update the utilization rate calculation to use the normalized debt (from getNormalizedDebt) instead of reserve.totalUsage.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

updateInterestRatesAndLiquidity() uses reserve.totalUsage while other functions use getNormalizedDebt(), causing inconsistent utilization rate calculations

Appeal created

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

ReserveLibrary calculates computedDebt and computedLiquidity but never uses them, leading to stale totalUsage and totalLiquidity values in utilization rate calculations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.